Cisco Systems OL-5490-01 Manuale Utente

Transparent tunneling allows secure transmission between the VPN Client and a secure gateway through 
a router serving as a firewall. The router might also be configured for Network Address Translation 
(NAT) or Port Address Translations (PAT). 

Transparent tunneling encapsulates Protocol 50 (ESP) traffic within UDP packets. It allows for both IKE 
(UDP 500) and Protocol 50 to be encapsulated in TCP packets before they are sent through the NAT or 
PAT devices and/or firewalls. The most common application for transparent tunneling is behind a home 
router performing PAT. 

Not all devices support multiple simultaneous connections behind them. Some cannot map additional 
sessions to unique source ports. Check with your device's vendor to see if this limitation exists. Some 
vendors support Protocol 50 (ESP) PAT, which might let you operate without enabling transparent 
tunneling. 

To use transparent tunneling, the IPSec group in the Cisco VPN device must be configured to 
support it. 

Transparent Tunneling is enabled by default. To disable this parameter, clear the check box. We 
recommend that you keep this parameter enabled.

The transparent tunneling mode you select must match the mode used by the VPN device providing your 
connection to the private network.

If you select IPSec over UDP (NAT/PAT), the default mode, the port number is negotiated.

If you select TCP, you must enter the port number for TCP in the TCP port field. This port number 
must match the port number configured on the VPN device. The default port number is 10000.

Either mode operates properly through a PAT device. Multiple simultaneous connections might work 
better with TCP, and if you are in an extranet environment, TCP mode is preferable. UDP does not 
operate with stateful firewalls. Use TCP with this configuration.

The Allow Local LAN Access parameter gives you access to resources on your local LAN when you are 
connected through a secure gateway to a central-site VPN device.

When this parameter is enabled:

You can access local resources (printer, fax, shared files, other systems) while connected.

You can access up to 10 networks. A network administrator at the central site configures a list 
of networks at the VPN Client side that you can access.

If you are connected to a central site, all traffic from your system goes through the IPSec tunnel 
except traffic to the networks excluded from doing so (in the network list). 

If enabled on the VPN Client and permitted on the central-site VPN device, you can see a list 
of the local LANs that are available by choosing Statistics from the Status menu and clicking 
the Route Details tab. For more information, see the